Method and device for detecting anomalies in technical systems

ABSTRACT

A computer-implemented method for detecting an anomaly in a technical system. The method includes detecting an environment state vector and a system state vector, the environment state vector including at least one first value which characterizes a physical environment condition or a physical operating condition of the technical system, and the system state vector including at least one second value which characterizes a physical condition of the technical system; ascertaining, using an environment anomaly model, an environment value which characterizes a probability or a probability density value with which the environment state vector occurs; ascertaining, using a system anomaly model, a system value which characterizes a conditional probability or a conditional probability density value with which the system state vector occurs if the environment state vector occurs; signaling the presence of an anomaly or signaling the absence of an anomaly based on the environment value and/or the system value.

CROSS REFERENCE

The present application claims the benefit under 35 U.S.C. § 119 ofGerman Patent Application No. DE 102020208642.7 filed on Jul. 9, 2020,which is expressly incorporated herein by reference in its entirety.

BACKGROUND INFORMATION

German Patent Application No. DE 10 2019 208 372.2 describes a methodfor monitoring an operating behavior of a technical system and fordetecting anomalies in technical systems, so that maintenance, a repairor a replacement of the technical system or of its components may beprompted.

To detect anomalies in technical systems in industrial environments, ingeneral a plurality of descriptive variables (also parameters) aredetected which characterize the operating condition of the system. Withthe aid of a data-based anomaly detection method, the instantaneouslydetected variables may be used, during ongoing operation, to determinewhether the system is operating correctly or whether an anomalousbehavior is present.

However, data-based anomaly detection methods have the disadvantage thatthey may output misevaluations when determining the presence of ananomaly. If an anomaly is erroneously detected, this may result forexample in an inadvertent shutdown of the system. It is also possiblethat an anomaly detection method does not recognize an anomaly as suchand the system continues to operate as normal. For example, it ispossible that an electric machine is consuming much more power than itwould normally. This may result in an inadvertent or even hazardousbehavior.

It is therefore vital that an anomaly detection method may provideaccurate information about the presence or absence of anomalous behaviorof the technical system. In this context, accuracy may be understood tomean the ability of the anomaly detection method to correctly recognizethe presence or absence of an anomaly.

An advantage of the method in accordance with the present invention isthat the accuracy of an anomaly detection method is increased andtherefore a better anomaly detection is possible. This enables areliable and safe operation of the technical system which is monitoredby the anomaly detection method.

SUMMARY

In a first aspect, the present invention relates to acomputer-implemented method for detecting an anomaly in a technicalsystem. In accordance with an example embodiment of the presentinvention, the method includes the following steps:

-   -   detecting an environment state vector and a system state vector,        the environment state vector including at least one first value,        the first value characterizing a physical environment condition        or a physical operating condition of the technical system, and        the system state vector including at least one second value, the        second value characterizing a physical condition of the        technical system;    -   ascertaining an environment value with the aid of an environment        anomaly model, the environment value characterizing a        probability or a probability density value with which the        environment state vector occurs;    -   ascertaining a system value with the aid of a system anomaly        model, the system value characterizing a conditional probability        or a conditional probability density value with which the system        state vector occurs if the environment state vector occurs;    -   signaling the presence of an anomaly or signaling the absence of        an anomaly based on the environment value and/or the system        value.

In the context of the present invention, a first value may be understoodas the result of a measurement of a physical environment condition or aphysical operating condition of the technical system. In particular,first values may be measured with the aid of sensors. A first value maycharacterize for example an air pressure of the environment of thetechnical system, a humidity of the environment of the technical system,an ambient temperature of the technical system,alpha/beta/gamma/UV/infrared radiation in the environment of thetechnical system, or an ambient brightness of the technical system.

Furthermore, a second value may be understood as the result of ameasurement of a physical condition of the technical system itself. Inparticular, second values may be measured with the aid of sensors. Asecond value may characterize for example an operating temperature ofthe technical system or of at least one part or one component of thetechnical system, a power consumption of the technical system or of atleast one part or one component of the technical system, a speed of thetechnical system or of at least one part or one component of thetechnical system, a rotational speed of the technical system or of atleast one part or one component of the technical system, a vibration ofthe technical system or of at least one part or one component of thetechnical system, or a pressure within the technical system or within atleast one part or one component of the technical system.

An environment state vector detected at a point in time and a systemstate vector detected at the same point in time may be regarded ascorresponding.

An environment state vector may be deemed anomalous if an occurrence ofthe environment state vector with regard to the occurrence of otherenvironment state vectors is improbable. A system state vector may bedeemed anomalous if an occurrence of the system state vector with regardto the occurrence of other system state vectors, and taking into accountthe corresponding environment state vector, is improbable. An anomalymay exactly be present in a technical system if the environment statevector is anomalous and/or the system state vector is anomalous.

The detection of anomalies based on first and second values makes itpossible to make the anomaly detection more accurate and to ascertainthe cause of an anomaly that has occurred. For this purpose, the anomalydetection method includes an environment anomaly model which is designedto ascertain, for a forwarded environment state vector, a probability ora probability density value in relation to the occurrence of theenvironment state vector. In this connection, a small probability or asmall probability density value may be understood to mean that theenvironment state vector is improbable and therefore there is probablyan anomaly concerning the parameters of the environment. This may occurfor example when the technical system is operating in an environment forwhich it has not been designed or in which it has not been tested.

In addition, in accordance with an example embodiment of the presentinvention, the anomaly detection method includes a system anomaly modelwhich is designed to ascertain a probability or a probability densityvalue in relation to the occurrence of the system state vector. Thismodel is advantageously designed in such a way that it ascertains theprobability or the probability density value in relation to theoccurrence of the system state vector as a function of the environmentstate vector, i.e., to ascertain an involved probability or aconditional probability density value. The advantage lies in the factthat the system anomaly model may evaluate whether the system statevector does or does not represent an anomaly in relation to itsenvironment, and need not decide this only on the basis of the systemstates alone. Compared to the evaluation of all parameters by a machinelearning model, the selected modeling by way of conditionalprobabilities or probability density values advantageously enriches themethod with additional knowledge concerning the relationships betweenenvironment parameters and system parameters. This effectuates a higheraccuracy of the anomaly detection method.

One example of this is a heating system which is intended to heat a roomto a predefined temperature. In this case, it is possible that theheating system reaches the temperature despite minimal energy or noenergy being supplied, which may typically be understood as an anomaly.However, it is possible that the room additionally has windows and thatthe room is already heated almost to the desired temperature by solarradiation. Therefore, in the context of the environment state variableof the solar radiation and the energy associated therewith, reaching theroom temperature while minimal energy supply is not an anomaly.

Advantageously, trainable methods from the field of machine learning maybe used as the environment anomaly model and/or the system anomalymodel, in particular a normalizing flow model as the environment anomalymodel and a conditional normalizing flow model as the system anomalymodel. An advantage of selecting these two models lies in the fact thatenvironment state vectors and system state vectors may be recorded forexample during a test operation or an acclimatization operation of thesystem, and the environment anomaly model may be trained directly withthe detected environment state vectors or the system anomaly model maybe trained with the detected environment state vectors and therespectively corresponding system state vectors. The normalizing flowmodel or conditional normalizing flow model allows that thecorrespondingly detected data need not first be manually annotatedbefore being able to be used for training, which in turn means that therespective model may be trained with more data in a certain period oftime than a monitored trainable model. The resulting increased quantityof training data means that the model in question is trained with moreknown environment and/or system states, which results in the anomalydetection becoming more accurate.

The example method described above may be understood as a method formonitoring a technical system. In the case that an anomaly has beenrecognized, the technical system may advantageously be activated in sucha way that potentially hazardous or undesirable behavior of the systemis minimized or prevented. For example, it is possible that thetechnical system is able to carry out various actions, and the choice ofpossible actions is minimized if an anomaly is recognized. One exampleof this is an at least semi-automated robot, such as an at leastsemi-automated vehicle. If an anomaly is detected during operation ofthe vehicle, the vehicle may be prohibited from certain actions thatwould otherwise be possible, for example prohibited from changing lanes.It is also possible that actions of the technical system will berestricted in their execution. In the example of the vehicle, forexample, it is possible that the maximum speed that the vehicle mayautomatically control is reduced, and the vehicle may thus move onlyslowly through its surroundings.

It is also possible that, in the step of signaling an anomaly, ananomaly is exactly signaled if the environment value with regard to apredefined first threshold value characterizes an improbable environmentstate vector and/or if the system value with regard to a predefinedsecond threshold value characterizes an improbable system state vector.

It is possible, for example, that an anomaly concerning the environmentwill be signaled if the environment value does not exceed the firstthreshold value. It is alternatively possible that, if the environmentvalue does not exceed the first threshold value, it is ascertainedwhether there is an anomaly concerning the system itself by comparingthe system value with the second predefined threshold value. In thiscase, an anomaly may be indicated if the system value is below thesecond threshold value.

It is also possible that the environment anomaly model is retrained withthe environment vector if the environment value with regard to thepredefined first threshold value characterizes an improbable environmentstate vector and if the system value with regard to the predefinedsecond threshold value characterizes a probable system state vector.

The case described may be understood as a situation in which, althoughthere is an improbable environment state, the technical systemnevertheless continues to operate correctly. This situation may arise inparticular if a particular environment for the system has not been takeninto account when ascertaining the environment anomaly model, but thesystem is not negatively affected by this environment. In this case,therefore, the environment anomaly model may be retrained with theupdated environment state vector.

An advantage of this procedure lies in the fact that the environmentanomaly model may independently automatically improve itself duringoperation of the system, and thus the anomaly detection accuracy may befurther increased.

In a further aspect of the present invention, it is possible that themethod for detecting anomalies is carried out by an anomaly detectiondevice, the anomaly detection device including an environment anomalymodel and a system anomaly model. In accordance with an exampleembodiment of the present invention, it is also possible that thetraining of the anomaly detection device includes the following steps:

-   -   ascertaining a plurality of environment state vectors and a        plurality of system state vectors, an environment state vector        including at least one first value, the first value        characterizing a physical environment condition or a physical        operating condition of the technical system, and a system state        vector including at least one second value, the second value        characterizing a physical condition of the technical system;    -   training the environment anomaly model of the anomaly detection        device based on the ascertained plurality of environment state        vectors;    -   training the system anomaly model of the anomaly detection        device based on the ascertained plurality of environment state        vectors and the respective corresponding system state vectors.

The plurality of environment state vectors and the plurality of systemstate vectors may be understood as a training data set for the anomalydetection device. To detect these training data, the technical systemmonitored by the anomaly detection device may be used for example in atest operation or training operation and a plurality of environmentstate vectors and a plurality of system state vectors may be recorded,which are then made available as a training data set. During operation,it is advantageously ensured that the system is operating correctly.

An advantage of this procedure lies in the fact that, with minimalmonitoring of the system (namely ensuring correct functioning during thetest operation or training operation), a large amount of training datamay be obtained, with which the anomaly detection device may be trained.This results in a high accuracy of the anomaly detection device.

It is also possible that, in the ascertaining step, environment statevectors and/or system state vectors of known anomalous states of thesystem are also ascertained, and the environment anomaly model and/orthe system anomaly model is/are trained in such a way that smallprobabilities or probability density values are ascertained for theseanomalous state vectors. This results in an even more accurateenvironment anomaly model and/or system anomaly model, which in turnimproves the accuracy of the anomaly detection device.

Specific embodiments of the present invention are explained in greaterdetail below with reference to the figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 schematically shows the structure of an anomaly detector inaccordance with an example embodiment of the present invention.

FIG. 2 schematically shows a structure of a control system foractivating an actuator, which uses the anomaly detector.

FIG. 3 schematically shows an exemplary embodiment for controlling an atleast semi-autonomous robot with the aid of the control system.

FIG. 4 schematically shows an exemplary embodiment for controlling amanufacturing system with the aid of the control system.

FIG. 5 schematically shows an exemplary embodiment for controlling anaccess system with the aid of the control system.

FIG. 6 schematically shows an exemplary embodiment for controlling amonitoring system with the aid of the control system.

FIG. 7 schematically shows an exemplary embodiment for controlling apersonal assistant with the aid of the control system.

FIG. 8 schematically shows an exemplary embodiment for controlling amedical imaging system with the aid of the control system.

FIG. 9 schematically shows an exemplary embodiment for training ananomaly detector.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

FIG. 1 shows an anomaly detector 70. Anomaly detector 70 receives aplurality of first and second values x₇), which are divided in adividing unit 71 into an environment state vector x_(U) of first valuesand a system state vector x_(S) of second values. Environment statevector x_(U) is fed to an environment anomaly model 72, which isdesigned to ascertain an environment value v_(U) that characterizes aprobability or a probability density value with which environment statevector x_(U) occurs. Environment anomaly model 72 is preferably anormalizing flow model.

Furthermore, environment state vector x_(U) and system state vectorx_(S) are fed to a system anomaly model 73, which is designed toascertain, for system state vector x_(S) and as a function ofenvironment state vector x_(U), a system value v_(S) that characterizesa conditional probability or a conditional probability density valuewith which system state vector x_(S) occurs. System anomaly model 73 ispreferably a conditional normalizing flow model.

Environment value v_(U) is compared in a first comparison unit 74 withan environment threshold value T_(U). If environment value v_(U) fallsbelow environment threshold value T_(U), the presence of an environmentanomaly is reported to an evaluation unit 76. In further specificembodiments, it is possible that the presence of an environment anomalyis reported to evaluation unit 76 even if environment threshold valueT_(U) and environment value v_(U) match.

System value v_(S) is compared in a second comparison unit 75 with asystem threshold value T_(S). If system value v_(S) falls belowenvironment threshold value T_(U), the presence of a system anomaly isreported to evaluation unit 76. In further specific embodiments, it ispossible that the presence of a system anomaly is reported to evaluationunit 76 even if system threshold value T_(S) and system value v_(S)match.

Evaluation unit 76 then ascertains, based on the presence or absence ofan environment anomaly and/or a system anomaly, an anomaly detectionoutput y₇₀ which characterizes the presence or the absence.

FIG. 2 shows an actuator 10 in its environment 20 in interaction with acontrol system 40. At preferably regular time intervals, environment 20is detected in multiple sensors 30. Sensors 30 include sensors by whichenvironment states and system states of control system 40 may bemeasured. In addition, sensors 30 also include imaging sensors, such ascameras for example. The signals of sensors S are transmitted to controlsystem 40. Control system 40 thus receives a sequence of sensor signalsS. From these, control system 40 ascertains activation signals A, whichare transmitted to actuator 10.

Control system 40 receives the sequence of sensor signals S from sensors30 in a receiving unit 50, which converts the sequence of sensor signalsS into a sequence of input images x₆₀ and a sequence of environmentstates and system states x₇₀. Input image x₆₀ may be, for example, adetail or a further processing of a sensor signal from a camera, whichis contained in sensor signal S. Input image x₆₀ includes individualframes of a video recording. In other words, input image x₆₀ andoperating states x₇₀ are ascertained as a function of sensor signal S.The sequence of input images x₆₀ is fed to an image classifier 60.Control system 40 also includes anomaly detector 70, to which thesequence of environment states and system states x₇₀ is fed.

Image classifier 60 is preferably parameterized by first parameters Φ₁,which are stored in a parameter memory P and are made available by thelatter. Anomaly detector 70 is preferably parameterized by secondparameters Φ₂, which are likewise stored in the parameter memory and aremade available by the latter.

From input images x₆₀, image classifier 60 ascertains output variablesy₆₀ which characterize a classification of input images x₆₀. Fromoperating states x₇₀, anomaly detector 70 ascertains an anomalydetection output y₇₀ which characterizes whether or not an anomaly ispresent.

Output variables y₆₀ and anomaly detection output y₇₀ are fed to aforming unit 80, which from these ascertains activation signals A whichare fed to actuator 10 in order to activate actuator 10 accordingly. Anoutput variable y₆₀ includes information about objects that may be seenon a corresponding input image x₆₀.

Actuator 10 receives activation signals A, is activated accordingly, andcarries out a corresponding action. Actuator 10 may in this case includeactivation logic (not necessarily structurally integrated), which fromactivation signal A ascertains a second activation signal, with whichactuator 10 is then activated.

If an anomaly is present, activation signal A may be selected in such away that the possible actions of actuator 10 are restricted. If noanomaly is present, it is possible that the possible actions arerestricted not on the basis of an anomaly, but rather on the basis ofenvironment 20 of control system 40 that has been ascertained by imageclassifier 60. It is also possible that, if an anomaly is present, atleast some of sensor signals S are transmitted to a manufacturer oroperator of control system 40.

In further specific embodiments of the present invention, control system40 includes sensor 30. In yet further specific embodiments, controlsystem 40 alternatively or additionally also includes actuator 10.

In further preferred specific embodiments, control system 40 includesone or multiple processors 45 and at least one machine-readable memorymedium 46, on which instructions are stored which, when executed onprocessors 45, prompt control system 40 to carry out a method accordingto the present invention.

In alternative specific embodiments of the present invention, a displayunit 10 a is provided as an alternative or in addition to actuator 10.

FIG. 3 shows how control system 40 may be used to control an at leastsemi-autonomous robot, here an at least semi-autonomous motor vehicle100.

Sensors 30 may in this case include, for example, a video sensor, whichis preferably situated in motor vehicle 100, as well as sensors formeasuring the ambient temperature, sensors for measuring the lightintensity, GPS sensors, sensors for measuring the fuel consumption,and/or sensors for measuring the engine speed.

Image classifier 60 is designed to identify objects from input imagesx₆₀.

Actuator 10, which is preferably situated in motor vehicle 100, may be,for example, a brake, a drive or a steering system of motor vehicle 100.Activation signal A may then be ascertained in such a way that the oneor multiple actuators 10 is/are activated in such a way that motorvehicle 100 prevents for example a collision with objects identified byimage classifier 60, particularly if these are objects of particularclasses, for example pedestrians.

In the case that anomaly detector 70 detects an environment anomaly or asystem anomaly, activation signal A may be selected in such a way thatthe vehicle may no longer change lanes and the speed is restricted to apredefined value. Alternatively, it is likewise possible that thecontrol of the vehicle is handed over to a driver or operator (notnecessarily located in the vehicle). It is also possible that theanomaly and sensor signals S that have resulted in the anomaly arestored in a fault memory of the control system, and/or a warning messageis output on a display device 10 a.

Alternatively, the at least semi-autonomous robot may also be adifferent mobile robot (not shown), for example a robot that moves byflying, swimming, diving or walking. The mobile robot may also be, forexample, an at least semi-autonomous lawnmower or an at leastsemi-autonomous cleaning robot. In these cases, too, activation signal Amay be ascertained in such a way that the drive and/or steering of themobile robot are activated in such a way that the at leastsemi-autonomous robot prevents for example a collision with objectsidentified by image classifier 60.

FIG. 4 shows an exemplary embodiment in which control system 40 is usedto activate a manufacturing machine 11 of a manufacturing system 200 byactivating an actuator 10 which controls this manufacturing machine 11.Manufacturing machine 11 may be, for example, a machine for punching,sawing, drilling and/or cutting.

Sensors 30 may include, for example, an optical sensor which detects forexample properties of manufactured products 12 a, 12 b. The sensors mayalso include such sensors that may measure the ambient temperature, theair pressure, the light intensity, the radiation, the speed of travel ofa conveyor belt and/or the power consumption of manufacturing machine11.

It is possible that manufactured products 12 a, 12 b are movable. It ispossible that actuator 10 which controls manufacturing machine 11 isactivated as a function of an assignment of detected manufacturedproducts 12 a, 12 b, so that manufacturing machine 11 accordinglyexecutes a subsequent processing step of the correct manufacturedproduct 12 a, 12 b. It is also possible that, by identifying the correctproperties of manufactured products 12 a, 12 b (i.e., withoutmisclassification), manufacturing machine 11 accordingly adapts the samemanufacturing step to process a subsequent manufactured product.

If anomaly detector 70 detects an anomaly, manufacturing machine 11 maybe stopped for example, and maintenance may be automatically requested.Alternatively, it is also possible that the presence of an anomaly isindicated to an appropriate technician for closer observation, but theoperation of manufacturing machine 11 is maintained.

FIG. 5 shows an exemplary embodiment in which control system 40 is usedto control an access system 300. Access system 300 may include aphysical access control, for example a door (401). Sensors 30 mayinclude a video sensor, which is designed to detect a person. Sensors 30may also include such sensors that may measure an ambient temperature,the light intensity, the time of day, the air pressure and/or the powerconsumption of actuator 10.

The detected image may be interpreted with the aid of image classifier60. If multiple persons are detected at the same time, the identity ofthe persons may be ascertained in a particularly reliable manner byassociating the persons (i.e., the objects) with one another, forexample by analyzing their movements. Actuator 10 may be a lock whichreleases the access control, or not, as a function of activation signalA, for example opens door 401 or not. For this purpose, activationsignal A may be selected as a function of the interpretation by objectidentification system (image classifier) 60, for example as a functionof the ascertained identity of the person. Instead of the physicalaccess control, a logical access control may also be provided.

For example, if an anomaly is detected, a technician may be contactedautomatically in order to check the correct functioning of access system300.

FIG. 6 shows an exemplary embodiment in which control system 40 is usedto control a monitoring system 400. This exemplary embodiment differsfrom the exemplary embodiment shown in FIG. 5 in that, instead ofactuator 10, display unit 10 a is provided, which is activated bycontrol system 40. For example, an identity of the objects recorded bythe video sensor may be reliably ascertained by image classifier 60 inorder for example, as a function thereof, to deduce those that aresuspicious, and activation signal A may then be selected in such a waythat this object is displayed by display unit 10 a in a mannerhighlighted in color.

FIG. 7 shows an exemplary embodiment in which control system 40 is usedto control a personal assistant 250. Sensors 30 preferably include anoptical sensor which receives images of a gesture of a user 249.

As a function of the signals of sensor 30, control system 40 ascertainsan activation signal A for personal assistant 250, for example as aresult of image classifier 60 carrying out gesture recognition. Thisascertained activation signal A is then transmitted to personalassistant 250 and thus activates the latter accordingly. Thisascertained activation signal A may in particular be selected in such away that it corresponds to a presumed desired activation by user 249.This presumed desired activation may be ascertained as a function of thegesture recognized by image classifier 60. Control system 40 may thenselect activation signal A for transmission to personal assistant 250 asa function of the presumed desired actuation and/or may selectactivation signal A for transmission to the personal assistant accordingto the presumed desired activation 250.

This corresponding activation may include for example that personalassistant 25 retrieves information from a database and reproduces it foruser 249 in a receivable manner.

If a detected anomaly is present, personal assistant (250) maycommunicate this to user 249 or may automatically inform a technician.

Instead of personal assistant 250, a household appliance (not shown), inparticular a washing machine, a stove, an oven, a microwave or adishwasher, may also be provided so as to be activated accordingly.

FIG. 8 shows an exemplary embodiment in which control system 40 is usedto control a medical imaging system 500, for example an MRI, X-ray orultrasound machine. Sensors 30 may include, for example, an imagingsensor. Sensors 30 may also include such sensors that may measure theambient temperature, the humidity, the radiation within imaging system500, the operating temperature of the imaging system and/or the powerconsumption of the imaging system.

Display unit 10 a is activated by control system 40. For example, imageclassifier 60 may ascertain whether an area recorded by the imagingsensor is suspicious, and activation signal A may then be selected insuch a way that this area is highlighted in color by display unit 10 a.

In further exemplary embodiments (not shown), anomaly detector 70 mayalso monitor a control system which does not use an image classifier 60.Particularly, if the behavior of the control system is determined by amultitude of executable rules, the anomaly detector may monitor theparameters of the environment and of the system itself, as in theexemplary embodiments above.

In the exemplary embodiments shown above, it is also possible thatenvironment anomaly model 72 is retrained with at least environmentstate vector x_(U) if evaluation unit 76 is notified of an anomalyconcerning environment value v_(U) but is not notified of an anomalyconcerning system value v_(S). This scenario may be regarded as asituation for which anomaly detector 70 has not been tested, butnevertheless the system functions correctly.

FIG. 9 shows an exemplary embodiment of a training system 140 which isdesigned to train an anomaly detector 70. For the training, a trainingdata unit 150 accesses a computer-implemented database St₂, database St₂including at least one training data set T, training data set Tincluding pairs x_(i) of environment state vectors and system statevectors.

Training data unit 150 ascertains at least one pair x_(i) of environmentstate vector and system state vector of training data set T andtransmits pair x_(i) to anomaly detector 70 to be trained. For theenvironment state vector and the system state vector, anomaly detector70 determines an environment value with the aid of the environmentanomaly model and a system value with the aid of the system anomalymodel.

The environment value and the system value are transmitted as an outputpair ŷ_(i), to a change unit 180.

Based on ascertained output pair ŷ_(i) and a desired output pair y_(i)of environment value and system, change unit 180 then determines newmodel parameters Φ′ for the environment anomaly model and the systemanomaly model. It is possible, for example, that both anomaly models aregiven by neural networks. In this case, change unit 180 may ascertainnew model parameters Φ′ with the aid of a gradient descent method, suchas Stochastic Gradient Descent or Adam.

Ascertained new model parameters Φ′ are stored in a model parametermemory St₁.

Desired output pair y_(i) may in particular be made up of desiredenvironment value and desired system value, the desired environmentvalue being a desired probability for the environment state vector or adesired probability density value, and the desired system value being adesired probability for the system state vector or a desired probabilitydensity value.

In further exemplary embodiments, the training described is repeatediteratively for a predefined number of iteration steps or is repeatediteratively until a difference between ascertained output pair ŷ_(i) anddesired output pair y_(i) falls below a predefined threshold value. Inat least one of the iterations, new model parameters Φ′ determined in aprevious iteration are used as model parameters Φ of the anomalydetector.

Training system 140 may also include at least one processor 145 and atleast one machine-readable memory medium 146 containing commands which,when executed by processor 145, prompt training system 140 to carry outa training method according to one of the aspects of the presentinvention.

The term “computer” encompasses arbitrary devices for processingpredefinable computing rules. These computing rules may be in the formof software, or in the form of hardware, or else in a mixed form ofsoftware and hardware.

What is claimed is:
 1. A computer-implemented method for a technicalsystem, comprising the following steps: obtaining sensor output;generating from the sensor output: an environment state vector thatincludes at least one first value characterizing a physical environmentcondition of an environment in which the technical system operates; anda system state vector that includes at least one second valuecharacterizing a physical condition of the technical system; using anenvironment anomaly model to ascertain as output an environment valuebased on the environment state vector, which is applied as input to theenvironment anomaly model, the environment value characterizing aprobability or a probability density value of an occurrence of the inputenvironment state vector; using a system anomaly model to ascertain asoutput a system value based on a combination of the environment statevector and the system state vector, which are both applied as input tothe system anomaly model, the system value characterizing a conditionalprobability or a conditional probability density value of an occurrenceof the input system state vector when the input environment state vectoroccurs; determining whether an anomaly is present based on theenvironment value and the system value; and controlling the technicalsystem based on a result of the determination.
 2. The method as recitedin claim 1, wherein the determining of whether the anomaly is presentincludes comparing the environment value to a predefined first thresholdvalue and comparing the system value to a predefined second thresholdvalue.
 3. The method as recited in claim 1, wherein the environmentanomaly model is a normalizing flow model and/or the system anomalymodel is a conditional normalizing flow model.
 4. The method as recitedin claim 2, further comprising retraining the environment anomaly modelin response to results of the determining of whether the anomaly ispresent being a predefined inconsistency between results of thecomparison to the predefined first threshold value and the comparison tothe predefined second threshold value, the predefined inconsistencybeing that: (a) a result of the comparison to the predefined firstthreshold value is that the environment state vector is anomalous; and(b) a result of the comparison to the predefined second threshold valueis that the system state vector is not anomalous.
 5. The method asrecited in claim 1, wherein the controlling includes, when the anomalyis determined to be present, at least temporarily stopping the technicalsystem.
 6. A device comprising: a processor; a memory storing anenvironment anomaly model and a system anomaly model; wherein theprocessor is configured to: obtain sensor output; generate from thesensor output: an environment state vector that includes at least onefirst value characterizing a physical environment condition of anenvironment in which the technical system operates; and a system statevector that includes at least one second characterizing a physicalcondition of the technical system; use the environment anomaly model toascertain as output an environment value based on the environment statevector, which is applied as input to the environment anomaly model, theenvironment value characterizing a probability or a probability densityvalue of an occurrence of the input environment state vector; use thesystem anomaly model to ascertain as output a system value based on acombination of the environment state vector and the system state vector,which are both applied as input to the system anomaly model, the systemvalue characterizing a conditional probability or a conditionalprobability density value of an occurrence of the input system statevector when the input environment state vector occurs; determine whetheran anomaly is present based on the environment value and the systemvalue; and control the technical system based on a result of thedetermination.
 7. A method for training an anomaly detection device, themethod comprising the following steps: ascertaining a plurality ofenvironment state vectors and a plurality of respective correspondingsystem state vectors, each of the environment state vectors including atleast one first value that characterizes a physical environmentcondition of an environment in which the technical system operates, andeach of the respective corresponding system state vectors including atleast one second value that characterizes a physical condition of thetechnical system; training an environment anomaly model of the anomalydetection device and a system anomaly model of the anomaly detectiondevice based on the ascertained plurality of environment vectors and therespective corresponding system state vectors; wherein the methodincludes at least one of the following two features (a) and (b): (a) thetraining includes iteratively modifying parameters of at least one ofthe environmental anomaly model and the system anomaly model, each ofone or more of the iterations including: obtaining a respective valuepair formed of a respective environment value characterizing aprobability or a probability density value of an occurrence of one ofthe environment state vectors and a respective system valuecharacterizing a conditional probability or a conditional probabilitydensity value of an occurrence of one the system state vectors when theone of the input environment state vector occurs; comparing the obtainedrespective value pair to an expected value pair; and modifying theparameters based on a result of the comparison; and (b) the training isperformed in response to the anomaly detection device generating apredefined inconsistency, the predefined inconsistency being that one ofthe environment state vectors is determined by the anomaly detectiondevice to be anomalous and that a corresponding one of the system statevectors is not anomalous.
 8. A training device configured to train ananomaly detection device, the training device comprising: a processor;and a memory storing an environment anomaly model and a system anomalymodel; wherein: the processor is configured to: ascertain a plurality ofenvironment state vectors and a plurality of respective correspondingsystem state vectors, each of the environment state vectors including atleast one first value that characterizes a physical environmentcondition of an environment in which the technical system operates, andeach of the respective corresponding system state vectors including atleast one second value that characterizes a physical condition of thetechnical system; train the environment anomaly model of the anomalydetection device and the system anomaly model of the anomaly detectiondevice based on the ascertained plurality of environment vectors and therespective corresponding system state vectors; and the training deviceincludes at least one of the following two features (a) and (b): (a) thetraining includes iteratively modifying parameters of at least one ofthe environmental anomaly model and the system anomaly model, each ofone or more of the iterations including: obtaining a respective valuepair formed of a respective environment value characterizing aprobability or a probability density value of an occurrence of one ofthe environment state vectors and a respective system valuecharacterizing a conditional probability or a conditional probabilitydensity value of an occurrence of one the system state vectors when theone of the input environment state vector occurs; comparing the obtainedrespective value pair to an expected value pair; and modifying theparameters based on a result of the comparison; and (b) the training isperformed in response to the anomaly detection device generating apredefined inconsistency, the predefined inconsistency being that one ofthe environment state vectors is determined by the anomaly detectiondevice to be anomalous and that a corresponding one of the system statevectors is not anomalous.
 9. A non-transitory machine-readable memorymedium on which is stored a computer program for a technical system, thecomputer program, when executed by a computer, causing the computer toperform the following steps: obtaining sensor output; generating fromthe sensor output: an environment state vector that includes at leastone first value characterizing a physical environment condition of anenvironment in which of the technical system operates; and a systemstate vector that includes at least one second value characterizing aphysical condition of the technical system; using an environment anomalymodel to ascertain as output an environment value based on theenvironment state vector, which is applied as input to the environmentanomaly model, the environment value characterizing a probability or aprobability density value of an occurrence of the input environmentstate vector; using a system anomaly model to ascertain as output asystem value based on a combination of the environment state vector andthe system state vector, which are both applied as input to the systemanomaly model, the system value characterizing a conditional probabilityor a conditional probability density value of an occurrence of the inputsystem state vector when the input environment state vector occurs;determining whether an anomaly is present based on the environment valueand the system value; and controlling the technical system based on aresult of the determination.
 10. A non-transitory machine-readablememory medium on which is stored a computer program for training ananomaly detection device, the computer program, when executed by acomputer, causing the computer to perform a method, the method includingthe following steps: ascertaining a plurality of environment statevectors and a plurality of respective corresponding system statevectors, each of the environment state vectors including at least onefirst value that characterizes a physical environment condition of anenvironment in which the technical system operates, and each of therespective corresponding system state vectors including at least onesecond value that characterizes a physical condition of the technicalsystem; training an environment anomaly model of the anomaly detectiondevice and a system anomaly model of the anomaly detection device basedon the ascertained plurality of environment vectors and the respectivecorresponding system state vectors; wherein the method includes at leastone of the following two features (a) and (b): (a) the training includesiteratively modifying parameters of at least one of the environmentalanomaly model and the system anomaly model, each of one or more of theiterations including: obtaining a respective value pair formed of arespective environment value characterizing a probability or aprobability density value of an occurrence of one of the environmentstate vectors and a respective system value characterizing a conditionalprobability or a conditional probability density value of an occurrenceof one the system state vectors when the one of the input environmentstate vector occurs; comparing the obtained respective value pair to anexpected value pair; and modifying the parameters based on a result ofthe comparison; and (b) the training is performed in response to theanomaly detection device generating a predefined inconsistency, thepredefined inconsistency being that one of the environment state vectorsis determined by the anomaly detection device to be anomalous and that acorresponding one of the system state vectors is not anomalous.
 11. Thetraining device as recited in claim 8, wherein the training includes theiteratively modifying the parameters of the at least one of theenvironmental anomaly model and the system anomaly model, the each ofone or more of the iterations including: the obtaining of the respectivevalue pair formed of a respective environment value characterizing aprobability or a probability density value of an occurrence of one ofthe environment state vectors and a respective system valuecharacterizing a conditional probability or a conditional probabilitydensity value of an occurrence of one the system state vectors when theone of the input environment state vector occurs; the comparing of theobtained respective value pair to the expected value pair; and themodifying of the parameters based on the result of the comparison. 12.The training device as recited in claim 8, wherein the training isperformed in response to the anomaly detection device generating thepredefined inconsistency, the predefined inconsistency being that theone of the environment state vectors is determined by the anomalydetection device to be anomalous and that the corresponding one of thesystem state vectors is not anomalous.